4

This question is in regards to Control Plane Protection, or CPPr -- not to be confused with Control Plane Policing (CoPP).

The major difference between CoPP and CPPr is that CPPr allows for more granular restricting of control plane traffic by separating the control plane traffic into three categories(also called Sub-Interfaces):

  • Control Plane Host sub-interface
  • Control Plane Transit sub-interface
  • Control Plane CEF-Exception sub-interface

The first and third are defined by Cisco as follows:

Control plane host subinterface: This interface receives all control plane IP traffic that is directly destined for one of the router interfaces (physical and loopback). Examples of control plane host IP traffic include tunnel termination traffic; management traffic; and routing protocols such as SSH, SNMP, internal BGP (iBGP), and EIGRP

Control plane CEF-exception subinterface: This control plane subinterface receives all traffic that is either redirected as a result of a configured input feature in the CEF packet forwarding path for process switching or directly enqueued in the control plane input queue by the interface driver (that is, ARP, external BGP (eBGP), OSPF, LDP, Layer 2 keepalives, and all non-IP host traffic). Control Plane Protection allows specific aggregate policing of this type of control plane traffic.

My question:

Why are some routing protocols considered Control Plane Host Subinterface, and others considered Control Plane CEF-Exception subinterface?

Namely from the document above: iBGP and EIGRP are Host subinterface, and eBGP and OSPF are CEF-Exception subinterface. Despite iBGP and eBGP both using TCP/179 unicast as their transports.

I'm trying to understand the different functions of all three categories/sub-interfaces, and the Routing Protocols being split across two of them confuses me.

Improve this question
6
  • It appears that the interface drivers actually handle eBGP and OSPF, while they do not handle iBGP and EIGRP.
    – Ron Maupin ♦
    May 5, 2016 at 18:48
  • @RonMaupin Yes, but why? I'm trying to understand it so it isn't just a memorization exercise =/
    – Eddie
    May 5, 2016 at 19:02
  • I really don't know. I can imagine that since OSPF can be configured directly on an interface (and required for OSPFv3), that would make sense for it. eBGP is usually configured for a directly connected neighbor, and that makes me wonder if using multihop changes the behavior.
    – Ron Maupin ♦
    May 5, 2016 at 19:06
  • It's intersting that I found this: Control-plane host subinterface —Subinterface that receives all control-plane IP traffic that is directly destined for one of the router interfaces. Examples of control-plane host IP traffic include tunnel termination traffic, management traffic or routing protocols such as SSH, SNMP, BGP, OSPF, and EIGRP.
    – Ron Maupin ♦
    May 5, 2016 at 19:15
  • It looks like you found a documentation bug. You should ask for a bounty. :)
    – Ron Maupin ♦
    May 5, 2016 at 19:49

1 Answer 1

Reset to default
3

The description is misleading, and it's something we need to fix/standarize (I'm with Cisco, will reach out to doc guys to fix it).

In reality:

  • Control Plane Host sub-interface - anything that hits control-plane of router, on one of it's interfaces (physical/logical); think: routing protocols, management protocols, etc.
  • Control Plane Transit sub-interface - traffic that's software-switched and is transit to router (like different types of tunnels, depending on IOS/IOS XE version)
  • Control Plane CEF-Exception sub-interface - anything that wasn't caught higher, and doesn't fit the CEF processing chain (software in software routers, or things like QFP in ASR1k/ISR4k) - here, the misleading part is 'directly enqueued in the control plane input queue by the interface driver (that is, ARP, external BGP (eBGP), OSPF, LDP, Layer2 Keepalives, and all non-IP host traffic)' - in reality, if you have multicast or non-IP traffic, along with QoS policies and/or tuning with BFD (UDP traffic but treated in special way) or SPD (buffering, again special kind of treating of selected, marked traffic) it may end up here, but normally, BGP/OSPF/LDP will hit host subinterface. Also note, that this subinterface will also get traffic with TTL<=1 (which may hit some BGP direct sessions and explains unclear note in the docs), packets that have IP Options set, with bad checksum and so on.

The trouble is, as feature was implemented around 12.4T, it was rewritten at least once to my knowledge for 12.4S (which became 15S), so it may behave differently on different hardware and software mixes. YMMV, so it's best to first configure the policies with some sane defaults and 'permit' actions, and then observe your platforms and network during normal work to build baseline. Then check if everything is understood and apply 'drop' actions to established thresholds.

Bear in mind 'normal work' should include reconvergence events. This is often missed with CoPP/CPPr and then leads to hard to troubleshoot problems.

Improve this answer
3
  • Brilliant. It looks like OSPF, along with eBGP (as expected), sends its packets with TTL of 1. Which is enough for me to wrap my head around why those protocols get handled by the CEF Exception Sub-interface. Thanks for yoru answer, Lukasz! Sorry it took so long to give you the checkmark.
    – Eddie
    May 26, 2016 at 20:57
  • EIGRP sends packets with a TTL of 2, for whatever reason. But that is why that one is handled by the Host subinterface.
    – Eddie
    May 26, 2016 at 21:01
  • 1
    There's a command to switch eBGP to a TTL of 255. What happens then, does it switch to the host plane from the CEF exception?
    – Brain2000
    Nov 10, 2017 at 2:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.